git-guardrails-claude-code skill: block git push and reset --hard in Claude Code

Source: mattpocock/skills · Maintainer: community: Matt Pocock · License: MIT · Checked: 26 October 2026

What is the git-guardrails-claude-code skill?

The git-guardrails-claude-code skill sets up a Claude Code hook that blocks destructive git commands, such as git push, git reset --hard and git clean -f, before Claude can run them. It is a one-time setup skill: Claude copies a bash script into your project or home folder and registers it in your settings file.

It comes from mattpocock/skills, Matt Pocock's collection. The SKILL.md description reads: "Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset in Claude Code."

As of 26 October 2026, its skills.sh page listed about 505,500 installs (snapshot, 26 October 2026).

One thing to know first: it sits in the repo's misc/ folder. The misc README calls these "Tools I keep around but rarely use, not promoted in the plugin," and a note in the repo says misc skills "are frozen. Bug reports, feature requests and PRs against them are closed."

What does it do?

The folder holds SKILL.md, scripts/block-dangerous-git.sh and agents/openai.yaml (Codex display metadata). The SKILL.md walks Claude through five steps:

1. Ask scope. This project only (.claude/settings.json) or all projects (~/.claude/settings.json).
2. Copy the hook script to .claude/hooks/block-dangerous-git.sh or ~/.claude/hooks/block-dangerous-git.sh and make it executable.
3. Add the hook under hooks.PreToolUse with the matcher Bash, merging into any existing settings rather than overwriting them.
4. Ask about customization, adding or removing patterns in the copied script.
5. Verify by piping a fake git push origin main command into the script, which should exit with code 2.

The project version of the settings entry looks like this:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

The script reads the hook input with jq, pulls out tool_input.command, and checks it with grep -E against these patterns: git push, git reset --hard, git clean -fd, git clean -f, git branch -D, git checkout ., git restore ., push --force and reset --hard. On a match it prints "BLOCKED: '' matches dangerous pattern ''. The user has prevented you from doing this." to stderr and exits with code 2.

That matches how the Claude Code hooks docs describe blocking: "Exit with code 2 to block the action," and "The message that comes with the block is your hook's stderr." The docs also note that Bash as a matcher "matches only the Bash tool," and that CLAUDE_PROJECT_DIR is "the project root where the session started."

How do you install it?

The plugin route in the README (claude plugin install mattpocock-skills@claude-plugins-official) does not include this skill: the repo's own instructions say skills in misc/ must not appear in the plugin. Install it on its own with the command shown on skills.sh:

npx skills add https://github.com/mattpocock/skills --skill git-guardrails-claude-code

The skills CLI installs to the current project by default; add -g for all projects. Per the Claude Code skills docs, project skills live in .claude/skills/<skill-name>/SKILL.md and personal skills in ~/.claude/skills/<skill-name>/SKILL.md.

The skill is written for Claude Code: it edits Claude Code settings files and uses Claude Code's hook format. Codex and Cursor read the same SKILL.md format (see Codex skills and Cursor skills), but the steps target Claude Code's settings files, so they don't carry over as written.

You need jq on your machine. The SKILL.md doesn't list it, but the script depends on it (see the limits below).

How do you use it?

The skill has no disable-model-invocation line, so Claude can load it when your request matches the description, or you can type /git-guardrails-claude-code.

Example prompts (suggestions, not quotes from the repo):

• Set up git guardrails so you can't push or hard reset in this repo.
• /git-guardrails-claude-code Install it globally for all my projects.
• Add git safety hooks, but also block git rebase and allow git checkout .
• Check that the git guardrail hook is working by testing it against git push.

After setup, a blocked command doesn't run, and Claude gets the BLOCKED message from the script's stderr. You run the blocked command yourself when you mean it.

Tips and limits

Most of these come from closed issues on the repo and from Claude Code's own docs, not from testing:

• It fails open without jq. Issue #898 points at line 4 of the script, COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command'), and reports that with no set -e and no status check, a machine without jq gets an empty command, no pattern matches, and every command is allowed. Install jq before you rely on it.
• Rewording slips past it. Issue #301 reports that git global options between git and the subcommand, as in git -C /any/repo push, defeat the patterns. Issue #898 adds git branch --delete --force and git clean -d -f. Both issues were closed as not planned, with the maintainer's triage reply pointing to the frozen status and advising not to rely on the hook as a safety guarantee.
• It can also over-block. Line 19 of the script is if echo "$COMMAND" | grep -qE "$pattern"; then, which searches the whole command string with no anchors. Read that way, any command that merely contains the text git push, such as a commit message mentioning it, matches too. Issue #301 reports the same false positive for echo "remember to git push later".
• Deny rules do similar work. Issue #465 asked what the skill adds over built-in deny rules. The Claude Code permissions docs show a Bash(git push *) deny rule, and say it isn't matched by git -C . push origin main, so it "isn't a security boundary around the program." For filesystem and network enforcement that doesn't depend on command text, the docs point to sandboxing.
• Hooks beat allow rules. Per the permissions docs, "A hook that exits with code 2 stops the tool call before permission rules are evaluated," so the block holds even if Bash is on your allow list.
• Keep the exit code at 2. The hooks docs say exit code 1 is a non-blocking error: "If your hook is meant to enforce a policy, use exit 2."

As of 26 October 2026, its skills.sh audits (Gen Agent Trust Hub, Socket and Snyk) all showed Pass, dated 15 September 2026. Gen Agent Trust Hub noted that the skill writes a persistent hook into your settings, which it judged acceptable because providing guardrails is the skill's stated purpose. The MIT License lets you copy and change the script, which the frozen-skills note encourages.

Save it in your Kipt library

In Kipt, open Skills and paste the skill's GitHub folder link into the import box. Kipt reads the SKILL.md and its files, including scripts/block-dangerous-git.sh; for a repo with many skills it shows a list to pick from. You can also drop the folder or a .zip. Your skills live in your own private GitHub repo and install into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with Matt Pocock or mattpocock/skills.

Similar skills

• Setup pre-commit skill: another frozen misc skill from the same repo, which adds Husky hooks that check code before each commit.
• Claude Code hooks: how PreToolUse and other hook events work, if you'd rather write your own guard.
• Claude Code permissions: allow, ask and deny rules for Bash commands.
• Git commit skill: a skill for writing commits, the other side of git hygiene with an agent.